Re: ideal setup

[Keith Young <kyoung () v-one com>]

Robert Cole wrote:

> Ok lets go for a not so dream setup. How about snort running on the firewall 
> machine and sending its logs to a syslog server. That a decent setup if the 
> syslog server is heavily protected as well?

Robert,

I wouldn't run Snort on the firewall for two reasons:
        * Snort will put the interfaces into promiscuous mode
        * running extra services usually isn't a good idea

What about running a Snort box outside and a Snort box inside which 
sends log data to the syslog server in the DMZ?

--

--
--Keith Young
-kyoung () v-one com




-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users